AZ-104 Implement and Manage Virtual Networking Practice Test 16 — 15 Questions

Question 1

Based on the exhibit, the web tier can reach the API subnet by name, but the traffic is still blocked. What should the administrator do?

Accepted Answer

Add the API VM NICs to the destination application security group.. The web tier can resolve the API subnet's name, but traffic is still blocked. This indicates that the network security group (NSG) rules are not correctly configured to allow traffic from the web VMs (in ASG-Web) to the API VMs (in ASG-API). By adding the API VM NICs to the destination application security group (ASG), the NSG rule that references ASG-API as the destination will match the API VMs, allowing the traffic. Without this, the NSG rule may be referencing an empty or incorrect destination, causing the traffic to be denied by the default deny rule.

Answer

Increase the priority number of the allow rule so it is evaluated earlier.

Answer

Replace the ASG with a service endpoint on the API subnet.

Answer

Remove the web VMs from ASG-Web because ASGs block traffic by default.

Question 2

A storage account has public network access disabled. A VM in a virtual network must access blob data privately, and the application must resolve the storage endpoint name to a private IP address. What should the administrator deploy?

Accepted Answer

A private endpoint for the storage account plus a private DNS zone linked to the virtual network. A private endpoint assigns the storage account a private IP from the VM's virtual network, enabling direct, secure access over the Microsoft backbone. A private DNS zone linked to the virtual network ensures the storage endpoint name (e.g., mystorageaccount.blob.core.windows.net) resolves to that private IP, meeting the requirement for private name resolution without relying on public DNS or hosts file entries.

Answer

A service endpoint for Microsoft.Storage and a custom hosts file entry on the VM

Answer

Allow trusted Microsoft services and keep using the public endpoint

Answer

A route table that sends traffic for the storage account's public IP to the VPN gateway

Question 3

An NSG rule allows TCP 8443 from ASG-Web to ASG-Api on the API subnet. The web VM NIC is already in ASG-Web, but the API VM was only placed in the subnet and not added to ASG-Api. Traffic still fails. What is the best fix?

Accepted Answer

Add the API VM's NIC to ASG-Api so the NSG rule can match the destination NIC.. The NSG rule specifies ASG-Api as the destination, but NSGs evaluate traffic based on the NIC membership in an ASG, not the subnet. Since the API VM's NIC is not added to ASG-Api, the rule cannot match the destination, so traffic is dropped by default (implicit deny). Adding the NIC to ASG-Api allows the NSG rule to correctly identify the destination and permit TCP 8443 traffic.

Answer

Add ASG-Api to the API subnet because ASGs are inherited from subnet membership.

Answer

Lower the rule priority number on the web subnet to make source traffic more specific.

Answer

Create a user-defined route from AppSubnet to API subnet to bypass the NSG.

Question 4

Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?

Accepted Answer

A public IP address resource that will be associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.

Answer

A NAT gateway on the GatewaySubnet to translate tunnel traffic.

Answer

A private endpoint in the GatewaySubnet for tunnel termination.

Answer

A network security group that allows inbound TCP 443 to the subnet.

Question 5

A VM in AppSubnet must reach a database VM in DbSubnet on TCP 1433. AppSubnet's NSG has an outbound deny rule for TCP 1433 to Any at priority 200. DbSubnet's NSG has an inbound allow rule for TCP 1433 from ASG-App to ASG-Db at priority 300. Both NICs are in the correct application security groups. Connectivity tests fail. What should the administrator change?

Accepted Answer

Create an outbound allow rule on AppSubnet with a lower priority number than 200 for TCP 1433 to ASG-Db.. The AppSubnet's NSG has an outbound deny rule for TCP 1433 to Any at priority 200, which blocks all outbound traffic on that port regardless of destination. To allow the VM in AppSubnet to reach the database VM in DbSubnet, an outbound allow rule must be created with a lower priority number (e.g., 100) so it is evaluated before the deny rule. This rule should specify the destination as ASG-Db (the application security group of the database VM) to precisely permit the required traffic.

Answer

Remove the inbound allow rule from DbSubnet so the default rules can take over.

Answer

Move the inbound allow rule on DbSubnet to priority 100 so it is evaluated sooner.

Answer

Assign the database VM NIC to ASG-App so the destination rule matches a broader group.

Question 6

Based on the exhibit, a help desk engineer cannot RDP from an approved admin subnet to a VM in Azure. What change should the administrator make so the connection is allowed?

Accepted Answer

Move Allow-RDP-Admin to a priority lower than 100.. The exhibit shows a deny rule with priority 100 that blocks all inbound traffic from the approved admin subnet, and an allow rule for RDP with a priority lower than 100 (e.g., 200). Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number first), the deny rule at priority 100 is evaluated before the allow rule at a lower priority, thus blocking the RDP connection. To allow the RDP traffic, the administrator must move the Allow-RDP-Admin rule to a priority lower than 100 (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the deny rule to use UDP instead of TCP.

Answer

Add the VM NIC to an application security group and leave the rules unchanged.

Answer

Delete the default AllowVNetInBound rule.

Question 7

An administrator creates a route table with a UDR for 10.20.0.0/16 and next hop type Virtual appliance. A VM in the subnet still does not send that traffic to the appliance. The route table contents are correct. What should be checked first?

Accepted Answer

Whether the route table is associated with the correct subnet.. The most common reason a UDR fails to take effect is that the route table is not associated with the subnet containing the VM. Even if the route table contents are correct, the VM's traffic will follow default system routes unless the route table is explicitly linked to the subnet. Association is a required step to override Azure's default routing behavior.

Answer

Whether the NSG has an outbound deny rule for port 80.

Answer

Whether the VM uses a managed identity.

Answer

Whether the virtual machine is in an availability set.

Question 8

Based on the exhibit, administrators can reach a web server from the approved subnet, but connections still fail. What is the most likely reason?

Accepted Answer

The deny rule has a higher priority and matches the traffic before the allow rule.. Network Security Groups (NSGs) evaluate rules in order of priority, where a lower priority number (e.g., 100) is evaluated before a higher number (e.g., 200). If a deny rule with a higher priority (lower number) matches the traffic before the allow rule, the traffic is blocked. In this scenario, the deny rule (priority 100) matches the source subnet and destination port 443 before the allow rule (priority 200) can permit it, causing connections to fail.

Answer

The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.

Answer

The destination port must be changed to 80 because NSGs cannot allow TCP 443.

Answer

The subnet requires a route table before HTTPS can be permitted.

Question 9

Based on the exhibit, which next hop will Azure use for traffic from the VM to 10.50.1.20?

Accepted Answer

Internet, because the /24 route is more specific than the default route.. Azure uses the most specific route (longest prefix match) to determine next hop. The route for 10.50.1.0/24 with next hop Internet is more specific than the default route 0.0.0.0/0, so traffic to 10.50.1.20 will be forwarded to the Internet, not the virtual appliance.

Answer

Virtual appliance 10.1.1.4, because all traffic always follows the default route.

Answer

Virtual network, because private IP addresses always stay inside Azure.

Answer

No route is selected, so the packet is dropped before leaving the subnet.

Question 10

Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.

Accepted Answer

Place the backend NICs in an ASG named ASG-Backend.. An Application Security Group (ASG) allows you to group backend VMs by their NICs, regardless of their private IP addresses. When backend VMs are rebuilt and receive new IPs, the ASG membership remains intact, so NSG rules referencing the ASG continue to work without manual updates. This decouples security rules from dynamic IP addresses.

Answer

Create a static route for the backend subnet to preserve the same IPs.

Answer

Use a service endpoint between the two subnets.

Answer

Add a load balancer health probe rule on TCP 8443 only.

Question 11

An existing application in AppSubnet1 must access an Azure Storage account. The team does not want to add a private endpoint or change DNS records, but they do want to allow access only from AppSubnet1. Which configuration should the administrator use?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.. Enabling the Microsoft.Storage service endpoint on AppSubnet1 allows traffic from that subnet to be routed directly to the Azure Storage service over the Azure backbone network, bypassing the internet. By then restricting the storage account's firewall to 'selected virtual networks' and adding AppSubnet1's virtual network and subnet, access is limited exclusively to that subnet without needing a private endpoint or DNS changes.

Answer

Create a private endpoint and remove all public network access from the storage account.

Answer

Add a network security group rule that allows outbound TCP 443 to the storage account.

Answer

Enable peering between AppSubnet1 and the storage account network.

Question 12

Two application teams created separate VNets for independent workloads. VNet-A uses 10.40.0.0/16 and VNet-B uses 10.40.128.0/17. The teams want to peer the VNets so both apps can communicate privately. What should the administrator do first?

Accepted Answer

Renumber one VNet so its address space no longer overlaps before creating the peering.. B is correct because Azure VNet peering requires non-overlapping address spaces. VNet-A (10.40.0.0/16) and VNet-B (10.40.128.0/17) overlap, as 10.40.128.0/17 is a subset of 10.40.0.0/16. Before peering can be established, one VNet must be renumbered to eliminate the overlap; otherwise, the peering creation will fail with an error indicating overlapping address spaces.

Answer

Create the peering now and add a route table to one VNet later.

Answer

Add an NSG rule that allows traffic between the two address ranges.

Answer

Enable gateway transit on both VNets so overlapping ranges can route through a shared gateway.

Question 13

An app on a VM must connect to Azure SQL Database without using the public endpoint. The database name must resolve to a private IP inside the VNet, and public network access should be disabled. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the Azure SQL server in the VNet.. A private endpoint assigns the Azure SQL Database server a private IP address from the VNet, allowing the VM to connect without using the public endpoint. This ensures traffic stays within the Microsoft backbone and the database name resolves to a private IP inside the VNet.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet.

Answer

Grant the VM's managed identity Reader on the SQL server.

Answer

Keep public network access enabled and restrict the firewall to the VNet.

Question 14

Based on the exhibit, web servers can reach a backend VM only after it is added to a specific group. What should the administrator change to allow the traffic to match the existing NSG rule?

Accepted Answer

Add api01's NIC to ASG-Api.. The exhibit shows that the NSG rule allows traffic from ASG-Web to ASG-Api. Since web01 is in ASG-Web, traffic from web01 to api01 is only permitted if api01 is a member of ASG-Api. Adding api01's NIC to ASG-Api ensures the destination matches the NSG rule, allowing the traffic.

Answer

Move the deny rule to priority 100.

Answer

Change the source of the allow rule from ASG-Web to VirtualNetwork.

Answer

Place api01 in the same subnet as web01.

Question 15

An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.. A service endpoint for Microsoft.Storage allows the subnet to send traffic to the storage account over the Azure backbone network using the storage account's public endpoint, without requiring a private IP address or DNS changes. The storage firewall then restricts access to only that subnet's traffic, meeting the security team's requirements.

Answer

Create a private endpoint and a private DNS zone for the storage account.

Answer

Allow access only from the VM public IP address.

Answer

Place the storage account in the same resource group as the VM.